The Financial Regulatory Authority (FRA) has issued a resolution that requires companies and entities engaged in non-banking financial activities to obtain cyber insurance, particularly if they operate a digital platform or electronic applications.
The decision emphasises that non-banking financial institutions (NBFIs) have to acquire the insurance policy from an insurance company licensed to operate in Egypt, and to renew it annually.
The resolution stipulates that companies and entities designated by the Authority and licensed to engage in non-banking financial activities are obligated to take the necessary measures to enhance their cyber security framework and protect sensitive systems and data, including technological infrastructure equipment and information systems.
The NBFIs must develop a framework for IT risk management and governance another for cyber security management and governance. Both frameworks have to be submitted to the FRA after they have been approved by the companies’ board of directors.
NBFIs are also required to conduct a stress test and prepare information security reports on an annual basis. They must provide the Authority with the reports, and the contract concluded with the entity obligated to conduct the stress test must include the obligation to provide the Authority with its results.
Compliance with the requirements contained in this decision is one of the conditions for the NBFIs to maintain their operating licences. The NBFIs are granted a grace period to comply with the cyber security requirements.